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REMARKS 

At the outset, Applicant notes that the examiner indicated that claims 9, 13, 14, 17-27 
contained allowable subject matter. In view of the amendments are remarks below. Applicant 
considers all of the claims to be allowable. 

The examiner rejected claims 2, 3, 5, 7,8,10, 1 1 and 16 under 35 U.S.C. 1 12, second 
paragraph as being indefinite. 

The examiner considered that these claims, which depend fi*om independent method 
claim 1, recite structural rather that process limitations and thus were indefinite. The examiner 
relies upon MPEP 21 14 for authority. 

Applicant disagrees with the premise of the examiner. Indeed, Applicant contends that 
there is nothing objectionable to inclusion of structural limitations in method claims. The section 
that the examiner cites MPEP 2114 says nothing that supports the examiner's position and rather 
is directed to explaining how claims drawn to an apparatus, must be structurally distinguished 
fi-om the prior art, or that the manner of operating a device does not differentiate an apparatus 
claim fi-om prior art that disclosed the structure of the apparatus, or that a prior art device can 
perform all of the fimctions of the claimed apparatus and still not anticipate the claim if there are 
structural differences. Nowhere in MPEP 21 14 is support found for a rejection of method claims 
under 35 U.S.C. 1 12, second paragraph simply because the claim includes structural features. 
However, in order to broaden the scope of these claims, the claims were amended to remove 
vmnecessary structural limitations. 

As amended, the claims are now definite. 

The examiner rejected claim 16 since the examiner did not understand how "the network 
could be inaccessible to the attacker *♦* 

Claim 16 depends from claiml5, which was amended to clarify the redundant network. 
As amended claim 15 recites a first plurality of monitors ♦** disposed at a second plurality of 
points in the network and a central controller that receives data from the plurality of monitors, 
over a different, redundant network Claim 16 requires that the different, redundant network 
is inaccessible to the attacker. Claim 15 recites two networks; one on which an attack on a 
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victim data center is being carried out, and the other a different network that carries data 
pertaining to data collected from monitors that monitor the network under attack. Accordingly, 
claim 16 is definite. 

The examiner provisionally rejected claims 1, 4, 6, 8, 12, 15, and 28 under the judicially 
created doctrine of obvious type double patenting in view of co-pending application serial no. 
10/062,974. 

Neither claims 1, 4, 6, 8, 12, 15, and 28 nor the remaining claims in the instant 
application claim the same invention as claims 1, 8, 15, 17, 20, 22 and 24 of co-pending 
application serial no. 10/062,974. For instance, Claim 1 of the instant application recites: 

1 . A method of thwarting denial of service attacks on a 
victim data center coupled to a network comprises: 

monitoring network traffic through monitors disposed at a 
plurality of points in the network; and 

communicating data from the monitors, over a hardened, 
redundant network, to a central controller. 

Claim 8 of the co-pending application, recites: 

8. A method of thwarting denial of service attacks on a 
victim data center coupled to a network comprises: 

monitoring network traffic through probes that are disposed 
between the victim data center and the network; and 

communicating data from the probes, over a dedicated 
network, to a cluster head device. 

Claim 1 of the instant application requires that monitoring has monitors disposed at a 
plurality of points in the network and that the monitors communicate data to a central controller. 
Claim 8 of the co-pending application requires that monitoring occurs through probes that are 
disposed between the victim data center and the network and that the probes commxmicate data 
to a cluster head device. Thus, clearly claims 8 and 1 do not claim the same invention. 

In the claims, the monitors are disposed in different points. In one case, the monitors 
communicate with a cluster head whereas in the case of claim 1 of the instant application the 
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monitors communicate with the central controller. A central controller is described in both 
applications. The central controller is not the same element as a cluster head which is shown in 
FIG. 3 of the co-pending case but is not shown in any of the figures of the instant application. 
Similar arguments apply for the other claims. 

Claims 1 and 8, as well as the other claims, claim inventions that are patentably distinct 
from one another. Consequently, the double patenting rejection under obviousness type double 
patenting is improper. 

Applicant has added new claims that depend on originally filed claim 28. As with claim 
28, these claims are distinct over the references. 

Applicant has enclosed an Information Disclosure Statement. Apphcant contends that the 
references enclosed neither describe nor suggest the features of AppUcant's invention whether 
taken alone or in combination with the cited art. 

Enclosed is a $200 check for excess claim fees. Please apply any other charges or credits 
to deposit account 06-1050. 
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